CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Products (Severity: CRITICAL)

CVE-2026-109618 · CVE-2026-109619

CVE-2026-109618 Impact of Critical Vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619) on Palo Alto Networks Produ

来源摘录 · Palo Alto Security Advisories

Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619 (Updated October 29)

CVE-2026-109618 · CVE-2026-109619

CVE-2026-109618 and CVE-2026-109619 are Critical vulnerabilities in PHP, a scripting language used globally for web serv

来源摘录 · Palo Alto Unit 42

Microsoft finally fixes VPN issues caused by September updates

Microsoft has resolved Always On VPN connection failures triggered after installing the September 2026 Windows 11 securi

来源摘录 · BleepingComputer

Binance links $6.3 billion crypto theft to compromised DevOps laptop

Binance, the world's largest crypto exchange, has linked the theft of about $6.3 billion in cryptocurrency to a DevOps e

来源摘录 · BleepingComputer

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

CVE-2026-116794

### Summary The agent server in `russh::keys::agent::server` never calls `Agent::confirm` before signing with a key tha

来源摘录 · GitHub Advisory

OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

CVE-2026-118669

## Summary OAuthlib's token grant handlers can authenticate one client while authorizing the grant type and requested s

来源摘录 · GitHub Advisory

AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

CVE-2026-96631

### Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forw

来源摘录 · GitHub Advisory

AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

CVE-2026-96632

## Summary AdminNeo inserts the database server's version string into a `` tag that carries a valid CSP nonce, without

来源摘录 · GitHub Advisory

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to...

CVE-2026-111497

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on

来源摘录 · NVD / OSV.dev

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matc...

CVE-2026-114656

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to

来源摘录 · NVD

Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

### Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged

来源摘录 · GitHub Advisory

imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution

## Summary The ICO loader allocates `data_size + BMP_FILE_HEADER_LEN` bytes after reading a 32-bit attacker-controlled

来源摘录 · GitHub Advisory

CISA Adds Actively Exploited GitLab RCE and Cisco Firewall DoS Flaws to KEV

CVE-2026-97229

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco an

来源摘录 · The Hacker News

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and lea...

CVE-2026-109618

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some co

来源摘录 · NVD

CrowdStrike Expands Falcon Adversary OverWatch Threat Hunting Across AI and Google Cloud

CrowdStrike Expands Falcon Adversary OverWatch Threat Hunting Across AI and Google Cloud

来源摘录 · CrowdStrike

The Privacy and Security Risks of Edge LLM Optimization

Edge deployment of Large Language Models requires optimization techniques that reduce memory, computation, and energy co

来源摘录 · arXiv cs.CR

Surprise Alone Learns Lies: Evidence-Gated Continual Learning for LLMs from Streaming Claims

Continual learning methods for large language models increasingly decide what to learn by surprise, keeping the inputs t

来源摘录 · arXiv cs.CR

InferD: A Honeypot Framework for AI Inference Infrastructure

Large language model serving stacks, commercial inference APIs, vector databases, and agent orchestration gateways are n

来源摘录 · arXiv cs.CR

Judging Before Propagation: Task-Graph Contextual Integrity for Multi-Agent Privacy

Multi-agent LLM systems increasingly rely on persistent memory and inter-agent communication. These capabilities create

来源摘录 · arXiv cs.CR

Where You Inject Matters: The Trust Region Effect in LLM Agents

LLM agents are increasingly adopted in long-horizon tasks and interact with diverse external environments. Despite their

来源摘录 · arXiv cs.CR